DHS AIS Miner

[Jon_Irish]

Has anyone gotted the DHS AIS Miner working in MineMeld? We have an account with DHS and I configured the Miner with our subscription id as well as our certs. The miner shows all green (see attached screen-shtot), but I am not getting any indicators. Not sure what I am doing wrong, and DHS doesn't support MineMeld. I noticed that Unit 42 wrote the prototype, so I was hoping one of them might be able to answer my post and point me in the right direction.

TIA,

Jon

[lmori]

Hi @Jon_Irish,

if you click on the stats of the Miner, do you see error counters incrementing?

luigi

[Jon_Irish]

Hi Luigi,

No, the error counters typically stay at 2 or 4 and never move from there. I am working with Dan James on this, and it appears that the feed we are getting from DHS has ACS/ISA markings, and MineMeld does not support them. Dan is working on some new code to add the support and he was able to get a subscription to the feed in question, so I think that we will probably get this working shortly.

Jon

[akapucu]

Hi John how was the integration setup? Are you only pulling data or you are pushing data too. Could you provide quick summary? Cert sharing setup etc.

[Jon_Irish]

Hello,

Currently we do not have this working. As soon as we get it working, DHS has asked me to write documentation for the process. I will also try to remember to post the write up here as well.

[Jon_Irish]

Hi Luigi,

Dan James mentioned that you might  be able to help me with a request I have. I am looking for a document that describes the entire makeup of the .yml file itself as well as all the possible options that can go into a prototype.

Thanks,

Jon

[akapucu]

Hi all,

Any update on this?

[Jon_Irish]

Here is the latest... I am working with one of the PA engineers on this. It appears that the Federal feed uses ACS/ISA markings and MineMeld does not support them. The PA engineer wrote some new code for this support and it was approved by the package maintainers and he is waiting for them to be merged into the code. No eta on when this will happen. We are making progress!

Jon

[alyssonalmeida]

Hi any update on this?

I was working with DHS to onboard and we have just purchased the certificate for this service.

Any progress from your side?

[Jon_Irish]

I heard from my contact at Palo Alto last week, and his code for support of the markings in the FEDGOV collection was approved and is waiting for the next release cycle to be pushed out. Once I get the updated code, I'll test everything and update this thread.

Jon

[alyssonalmeida]

Here is working fine....

[Jon_Irish]

My problem was that we were using a special feed (FedGov) as we are a gov't entity. PaloAlto had to write some new code to get it to work. Last week's update included that code, and it is now working fine for us as well.

Last week, PaloAlto released MineMeld 0.9.48. If you are a gov't subscriber trying to use the FedGov feed, update to this release, and it should now work for you.

Jon

[Jon_Irish]

So the DHS FEDGOV feed is "officially" working with MineMeld v0.9.48! I have had it up and running all week, and I current have over 17K "indicators" in MineMeld from the dhs.FEDGOV feed.

If you are a government entity and want to utilize the DHS TAXII feed with MineMeld, make sure that you are running at least v0.9.48 and make sure that you select the dhs.FEDGOV prototype. You will also need a valid DoD cer6tificate for your MineMeld sever (a self-signed cert will NOT work).

Jon

[DLVS32017]

anyone know if a wildcard cert will work for this? 

[stratuscyber]

Hi,

I'm new to MineMeld and trying to get the DHS AIS feed setup, but I'm a little confused as how to configure my certs and subscription ID. I don't see a way to do so. 

Is there a guide for this?